A disabled button is a user-interface affordance, not a concurrency control. On a shared tablet at eight on a Friday, a re-render lagging half a second behind a second tap is normal, and the result is two orders, two kitchen tickets and a doubled bill.
The fix is an idempotency key derived from the intent — the round, the scope and the exact set of pending lines — rather than minted fresh on each click. Two taps of the same round send the same key and the server collapses them; a genuinely new round mints a new one.
The same discipline runs through the cart. Every mutation carries the cart version it believed it was editing, and a stale version is refused with a conflict rather than silently overwriting a colleague's change on another tablet.
None of this is visible when it works, which is rather the point.